ST STM32U585 Series Manuel utilisateur

Introduction

This document describes how to prepare STM32U585xx microcontrollers to make a secure system solution compliant with

SESIP Profile for PSA Level 3 using the STM32Cube_FW_U585_Security_certification_V1.0.0 software package included in the

STM32CubeU5 MCU Package.

The B-U585I-IOT02A board integrating the STM32U585AI microcontroller is used as the hardware vehicle to implement and test

a non‑secure application using secure services but it does not bring any additional security mechanism.

The security guidance described in this document applies to any boards based on STM32U585xx microcontrollers.

STM32U585xx security guidance for PSA Certified™ Level 3 with SESIP Profile

UM2852

User manual

UM2852 - Rev 1 - June 2021

For further information contact your local STMicroelectronics sales office.

www.st.com

1General information

The STM32CubeU5 TFM application runs on STM32U585xx 32-bit microcontrollers based on the Arm®

Cortex®‑M processor.

Note: Arm® is a registered trademark of Arm Limited (or its subsidiaries) in the US and/or elsewhere.

UM2852

General information

UM2852 - Rev 1 page 2/27

The following table presents the definition of acronyms that are relevant for a better understanding of this

document.

Table 1. List of acronyms

Acronym Description

AEAD Authenticated encryption with associated data

CLI Command‑line interface

EAT Entity attestation token

GUI Graphic user interface

HDP Secure hide protection

HUK Hardware unique key

HW Hardware

IAT Initial attestation

IPC Interprocess communication

ITS Internal storage service. Internal storage service provided by TF-M.

NSPE Non‑secure processing environment PSA term. In TF-M this means a non‑secure domain typically running an

operating system using services provided by TF-M.

MPU Memory protection unit

PSA Platform security architecture. Framework for securing devices.

RDP Readout protection

RoT Root of Trust

SBSFU Secure boot and secure firmware update. In the STM32CubeL5 this is the name of the TF-M based application,

with secure boot and secure firmware update functionalities only.

SESIP Security evaluation standard for IoT platforms

SFN Secure function. An entry function to a secure service. Multiple SFN per SS are permitted.

SP Secure partition. A logical container for a single‑secure service.

SPE Secure processing environment PSA term. In TF-M this means the secure domain is protected by TF-M.

SPM Secure partition manager. The TF-M component is responsible for the enumeration, management, and isolation of

multiple secure partitions within the TEE.

SS Secure service. A component within the TEE that is atomic from a security or trust point of view, meaning which is

viewed as a single entity from a TF-M point of view.

SST Secure storage service. Secure storage service provided by TF-M.

SW Software

TBSA-M Trusted base system architecture for Arm® Cortex®-M

TFM In the STM32CubeU5 this is the name of the TF‑M‑based application with complete functionalities.

TF-M Trusted firmware for M-class Arm. TF‑M provides a reference implementation of secure world software for

Armv8‑M.

TOE Target of evaluation

WRP Write protection

UM2852

General information

UM2852 - Rev 1 page 3/27

2Reference documents

Name Title/description

RM0456 Reference manual STM32U575/585 Arm®-based 32-bit MCUs (RM0456) – Revision 1

AN4992 Application note STM32 MCUs secure firmware install (SFI) overview (AN4992) – Revision 10

UM2237 User manual STM32CubeProgrammer software description (UM2237) – Revision 15

UM2851 User manual Getting started with STM32CubeU5 TF

‑

M applications (UM2851) – Revision 1

[Security Target] Security Target for STM32U585 family of device compliant with SESIP profile for PSA Certified

Level 3 – V1.0

[PSA_ST_API] PSA Storage API – 1.0.0

[PSA_CRYPTO_API] PSA Cryptography API – 1.0.0

[PSA_ATTESTATION_API] PSA Attestation API – 1.0.0

[IEE1149] EEE 1149.1 – 2013

[ADI5] Arm Debug Interface Architecture Specification ADIv5.0 to ADIv5.2

UM2852

Reference documents

UM2852 - Rev 1 page 4/27

3Preparative procedures

This chapter describes the procedures to prepare the environment and the product before starting to use the

product or before testing the product:

• Secure acceptance: procedures to check the product to be tested

• Secure preparation of the operational environment: procedures to set up the environment needed to manage

and test the product.

• Secure installation: procedure to program and configure the product to be tested

• Tera Term connection preparation procedure: procedure to configure the Tera Term tool before starting to

test the product.

3.1 Secure acceptance

Secure acceptance is the process in which the user securely receives the TOE and verifies the integrity and

authenticity of all its components.

The TOE is distributed as an MCU with a source code package.

The integrator receives the MCU directly from ST via a secure courier.

To ensure that MCU is not manipulated during TOE delivery, the integrator must verify that the user Flash is virgin

(reading 0xFF everywhere with STM32CubeProgrammer) or must do an RDP regression (Level 1 -> level 0) that

erases the user Flash.

The software package can be obtained through the standard ST support channels.

Note that it is the responsibility of the integrator to choose the correct STM32CubeU5 MCU Package version.

• How to accept the STM32U585xx microcontroller: by reading, with STM32CubeProgrammer (for more

details, refer to UM2237), the DBGMCU_IDCODE register value (0x2001 6482) at the 0xE004 4000

base address (for more details, refer to RM0456), and the bits 0, 2, 5, and 7 of byte at the 0x0BFA 0501

base address in system memory that are all set:

– DBGMCU identity code register (DBGMCU_IDCODE)

◦ Base address: 0xE004 4000

◦ Address offset: 0x00

◦ Reset value: 0x2001 6482

• Bits [31:16] REV_ID[15:0]: revision 0x2001: revision X

• Bits [15:12] Reserved

• Bits [11:0] DEV_ID[11:0]: device identification

•0x482: STM32U575/585

– System memory byte at 0x0BFA 0501 base address

◦ Bit 7 (DPA enable): 0b1

◦ Bit 5 (OTFDEC enable): 0b1

◦ Bit 2 (PKA enable): 0b1

◦ Bit 0 (AES enable): 0b1

• How to accept STM32Cube_FW_U585_Security_certification_V1.0.0 software package: By comparing the

SHA256 value of the STM32Cube_FW_U585_Security_certification_V1.0.0.exe file obtained with

the sha256sum.exe tool, to those in the [Security Target] document.

UM2852

Preparative procedures

UM2852 - Rev 1 page 5/27

• How to check the complete TOE once implemented on the STM32U585xx chip: By comparing values in the

[Security Target] document to the those that TOE provides through the PSA Initial Attestation services (psa_

initial_attest_get_token function):

– Hardware version: It contains the decimal format of REV_ID and DEV_ID fields of the

DBGMCU_IDCODE register that allows identifying the STM32U585xx hardware (04080202000001).

– Implementation ID: It contains the SHA256 value computed on the immutable software code

part of the TOE (TFM_SBSFU_Boot code binary data). Once TOE is configured, this value is

fixed as it corresponds to the immutable part of the TOE (excluding TOE personalization data).

This value changes in case the integrator changes the Flash memory layout of the regions

managed by the TOE or in case the integrator changes the TOE software configuration. Refer

to Section 4.2.1 User‑accessible functions and privileges (AGD_OPE.1.1C) to get details on the

software configuration.

– SPE measurement value: It contains the SHA256 value computed on the up-datable software code

part of the TOE (secure image code). This value is related to the TOE and can be verified only if the

secure application code is not changed (customized by the integrator at first installation or updated

through the secure update procedure). Any code changes in the code running in the security or

privilege domain (included in the TOE scope) and any code changes in the code running in the secured

or unprivileged domain (not included in the TOE scope) changes the value.

– NSPE measurement value: It contains the SHA256 value computed on the non-secure image code.

This value is not related to the TOE and is changed as soon as the non-secure image code is changed

(customized by the integrator at first installation or updated through the secure update procedure).

• These TOE values can be obtained with this procedure:

1. Run TFM User Application menu, then press #2 (Test TFM), then #7 (TFM - Test EAT).

2. Copy the token response in Middlewares\Third_Party\trustedfirmware\tools\iat-verif

ier\st_tools\eat.txt.

3. Decode token response, from Middlewares\Third_Party\trustedfirmware\tools\iat-ver

ifier\st_tools:

◦python build.py cbor ./eat.txt ./eat.cbor

◦check_iat -k ../../../../../../Projects/B-U585I-IOT02A/Applications/TFM/TFM_SBSFU_Boot/Src/

tfm_initial_attestation_key.pem ./eat.cbor -p

The measurement is decoded from the EAT token response obtained, and displayed.

3.2 Secure installation and secure preparation of the operational environment

(AGD_PRE.1.2C)

Installation of the TOE corresponds to generating the binary image and loading it into the MCU memory. In the

case of the B-U585I-IOT02A development board, this can be performed using the STM32CubeProgrammer via

USB and connecting to the target. Before this installation is possible, the integrator must implement some drivers

that are required by the TOE. In the case of the B-U585I-IOT02A development board, this implementation is

already provided in the software package.

This section describes the hardware and software setup procedures.

3.2.1 Hardware setup

To set up the hardware environment, the B-U585I-IOT02A development board must be connected to a personal

computer via a USB cable. This connection with the PC allows the user:

• Flashing the board

• Interacting with the board via a UART console

• Debugging when the protections are disabled

The ST-LINK firmware programmed on the development board must be the V3J8M3 version.

UM2852

Secure installation and secure preparation of the operational environment (AGD_PRE.1.2C)

UM2852 - Rev 1 page 6/27

3.2.2 Software setup

This section lists the minimum requirements for the developer to set up the SDK on

a Windows® 10 host, run the sample scenario and customize applications delivered in

STM32Cube_FW_U585_Security_certification_V1.0.0 software package.

STM32Cube_FW_U585_Security_certification_V1.0.0 software package

Copy STM32Cube_FW_U585_Security_certification_V1.0.0 software package on the Windows® host hard disk,

for example at C:\data, or any other path that is short enough and without any space.

Development toolchains and compilers

In the context of the security certification, the TFM tests are performed using IAR Systems® projects delivered in

the STM32Cube_FW_U585_Security_certification_V1.0.0 software package, so IAR Embedded Workbench® tool

(version 8.50.6) must be installed on the host, together with the IAR Embedded Workbench® patch to support

STM32U585xx devices (EWARMv8_STM32U57x-58x_V0.10.zip located in the software package in the Utili

ties\PC_Software\IDEs_Patches\EWARM directory).

Software tools for programming STM32 microcontrollers

STM32CubeProgrammer (STM32CubeProg) is an all-in-one multi-OS software tool for programming STM32

microcontrollers. It provides an easy-to-use and efficient environment for reading, writing, and verifying device

memory through both the debug interface (JTAG and SWD) and the bootloader interface (UART and USB).

STM32CubeProgrammer offers a wide range of features to program STM32 microcontroller internal memories

(such as Flash, RAM, and OTP) as well as external memories. STM32CubeProgrammer also allows option

programming and upload, programming content verification, and microcontroller programming automation through

scripting.

STM32CubeProgrammer is delivered in GUI (graphical user interface) and CLI (command-line interface) versions.

The STM32CubeProgrammer tool version to use for the TFM tests in the context of the security certification is

v2.8.0 (v2.8.0-A01 preliminary version).

For more details about STM32CubeProgrammer, refer to UM2237.

Terminal emulator

A terminal emulator software is needed to run the non-secure application. It allows displaying some debug

information to understand operations done by the embedded applications and it allows to interact with the

non‑secure application to trig some operations.

The example in this document is based on Tera Term, an open‑source free software terminal emulator that can

be downloaded from the https://osdn.net/projects/ttssh2/ webpage. Any other similar tool can be used instead

(Ymodem protocol support is required).

3.3 Secure installation

The STM32U585xx product preparation is done in 4 steps, to get a complete installation with security fully

activated, the 4 steps must be done as security protections are only configured at the very last step:

• Step 1: STM32U585xx chip initialization

• Step 2: Software compilation

• Step 3: Software programming into the STM32U585xx chip internal Flash memory

• Step 4: STM32U585xx static security protection configuration

Refer to UM2851, for the description of the four steps of the secure installation procedure.

In the context of security certification, the TFM_SBSFU_Boot project must be compiled in production mode.

UM2852

Secure installation

UM2852 - Rev 1 page 7/27

The certified configuration is the following:

• RDP level 2 with password capability

• Two firmware images

• Two slots per firmware image

• Image upgrade in overwrite mode

• Hardware‑accelerated cryptography enabled

• RSA 2048 asymmetric crypto scheme

• Image encryption in AES-CTR 128 mode enabled

• Internal Anti-tamper

• Standalone external loader capability

• Application RoT partition disabled

The option bytes configuration for the certified configuration is the following:

• RDP level 2

• SECBOOTADD0 = 0x180080 (0x0c004000 address)

• NSBOOTADD0 = SECBOOTADD0

• NSBOOTADD1 = SECBOOTADD0

• BOOT_LOCK set

• SECWM1 enabled, with SECWM1_PSTRT = 0 (0x08000000 address) and SECWM1_PEND = 0x28

(0x08050000 address)

• HDP1 enabled, with HDP1_PEND = 0xa (0x0c015fff address)

• WRP1A enabled, with WRP1A_PSTRT = 0x1 (0x08002000 address) and WRP1A_END = 0xb

(0x08016000 address), and WRP1A locked (UNLOCK_1A unchecked)

• SECWM2 disabled

• HDP2 disabled

• WRP2A enabled with WRP2A_PSTRT = 0x1 (0x08002000 address) and WRP1A_END = 0xb

(0x08016000 address)

The Flash memory layout for the certified configuration is shown in Figure 1.

Figure 1. Flash memory layout for certified configuration

UM2852

Secure installation

UM2852 - Rev 1 page 8/27

4Operational user guidance

4.1 User roles

The following user roles are distinguished for this TOE:

• Integrator

The integrator is the one to receive the TOE, perform the preparative procedures as described in

Section 3 Preparative procedures, and integrate the TOE into a full IoT solution. The user operational guidance

is described in Section 4.2 Operational guidance for the integrator role.

The integrator is responsible for personalizing the product data and for configuring the security of their product

following the guidelines provided by STMicroelectronics.

The integrator has full access to the source code delivered in the software package, has full access to the

STM32U585xx chip security features (The STM32U585xx chip is delivered as a virgin state without any security

features activated) that will be integrated on its board and has full access to the tools needed to program the

TOE.

4.2 Operational guidance for the integrator role

4.2.1 User‑accessible functions and privileges (AGD_OPE.1.1C)

The main task of the integrator is to integrate the TOE into a full IoT solution. To this end, the system integrator

has access to interfaces that are unavailable for other users, as described in Section 4.2.2 Available interfaces

and methods of use (AGD_OPE.1.2C and AGD_OPE.1.3C). The integrator can also change some parts outside

or inside the TOE, nevertheless, some changes may impact the certified configuration of the TOE. The TOE

scope evaluated covers all parts located in the secure domain except the part located in the secure unprivileged

domain that is isolated from the secure privilege domain:

Figure 2. TOE scope

Follow procedures described in Section 3.1 Secure acceptance to check if the TOE in the certified configuration

is used. The certified configuration of the TOE may be impacted when changing some parts of the TOE but may

also be impacted when changing some parts located outside the TOE scope. This section describes changes that

the integrator can do and clarify what is covered in the scope of the evaluation and what may impact the certified

configuration of the TOE.

The integrator must follow the guidelines described in that section, as a failure to do so means that the TOE is not

used in the certified configuration.

UM2852

Operational user guidance

UM2852 - Rev 1 page 9/27

RDP Level

The TOE is certified in RDP level 2 with an OEM2 password. The OEM2 password gives the flexibility in a

first step to perform RDP regression from level 2 to level 1, then to perform RDP regression from level 1 to

level 0 (provoking a Flash memory mass erasure) in a second step. It must be noticed that at the RDP level

1 intermediate state, the TOE is not anymore in the certified configuration whereas the security assets are still

present in Flash memory (personalized data area). The integrator has the privilege and responsibility to provide

its OEM2 password (64 bits) when the RDP level is still 0. The OEM2 password can be provisioned using

the STM32CubeProgrammer CLI command. To provision 0xFACEB00C 0xDEADBABE OEM2 password example

value, the STM32CubeProgrammer CLI command is:

./STM32_Programmer_CLI -c port=SWD mode=UR --hardRst -lockRDP2 0xFACEB00C 0xDEADBABE

In case the OEM2 password is not defined, then RDP level 2 is a final state, it is not possible to perform any RDP

regression. To use the certified configuration, the integrator must set the RDP to Level 2. The usage or not of the

OEM2 password is also part of the certified configuration.

Number of images

The TOE is certified in 2 images configuration. In this configuration, there are two distinct firmware images

for the secure and non‑secure applications, so that the firmware images are smaller, and the secure

and non‑secure images can be managed by two distinct entities. This configuration is achieved thanks to

MCUBOOT_IMAGE_NUMBER defined in Linker\flash_layout.h file.

#define MCUBOOT_IMAGE_NUMBER 2 /* 1: S and NS application binaries are assembled in one

single image.

2: Two separated images for S and NS application binaries.

It is possible to configure the number of images to one single image where the secure and non‑secure

applications are assembled so that the boot time is reduced. The laboratory has assessed the security of

both single and separate images. However, to use the certified configuration, SPE and NSPE images must be

separated.

Slot mode

The TOE is certified in primary and secondary slots configuration. In this configuration, for each image, there is a

primary slot for firmware image execution and a secondary slot for firmware image download in the Flash memory

layout. This configuration allows performing over‑the‑air firmware image updates, as the download of an image in

a secondary slot can be performed by firmware image executing in the primary slot. To get this configuration, the

define MCUBOOT_PRIMARY_ONLY line must be commented in Linker\flash_layout.h file.

/* #define MCUBOOT_PRIMARY_ONLY */ /* Defined: No secondary (download) slot(s), only primary

slot(s) for each image.

Undefined: Primary and secondary slot(s) for each

image. */

It is possible to configure the slot mode to a primary only slot, for which the slot area size can be maximized,

but over‑the‑air firmware update is not possible, as it is impossible to download the image in a slot where the

application is executing. The laboratory has assessed the security of primary‑only slot configuration and primary

and secondary slots configuration. However, to use the certified configuration, the integrator must use both

primary and secondary slots configuration.

UM2852

Operational guidance for the integrator role

UM2852 - Rev 1 page 10/27

Table des matières

Autres manuels ST Microcontrôleur

ST STM32F10 Series Instructions d'installation et d'utilisation

ST SPIRIT1 Manuel utilisateur

ST VD6283 Manuel utilisateur

ST STM32L4x6 Manuel utilisateur

ST UM2135 Manuel utilisateur

ST Turbo+ mPSD DK3400 Manuel utilisateur

ST STM32MP135F-DK Manuel utilisateur

ST Sound Terminal STA333W Manuel utilisateur

ST STM32F101xx series Manuel utilisateur

ST STM32MP157C-DK2 Manuel utilisateur

ST Turbo uPSD DK3300-ELCD Manuel utilisateur

ST STM32F205 series Manuel utilisateur

ST SPC56A Series Manuel utilisateur

ST ST624 B-EMU2 Series Manuel utilisateur

ST STM8S Manuel utilisateur

ST VIP-M07SPI-ADIS Manuel utilisateur

ST STM32F746NGH6 Manuel utilisateur

ST UM2708 Manuel utilisateur

ST STM32G4 Series Manuel utilisateur

ST STM8A-DISCOVERY Manuel utilisateur

ST STM8S Instructions d'installation et d'utilisation

ST STEVAL-STWINBX1 Manuel utilisateur

ST STM8A Instructions d'installation et d'utilisation

ST STM32L0 Series Instructions d'installation et d'utilisation

Manuels Microcontrôleur populaires d'autres marques

AMS

AMS AS7261 Demo Kit Manuel utilisateur

Novatek

Novatek NT6861 Manuel utilisateur

Espressif Systems

Espressif Systems ESP8266 SDK Guide de configuration

Nuvoton

Nuvoton ISD61S00 ChipCorder Mode d’emploi

STMicrolectronics

STMicrolectronics ST7 Assembler Linker Manuel utilisateur

Texas Instruments

Texas Instruments Chipcon CC2420DK Manuel utilisateur

Lantronix

Lantronix Intrinsyc Open-Q 865XR SOM Manuel utilisateur

NEC

NEC 78GK0S/K 1+ Series Instructions d'installation et d'utilisation

Mikroe

Mikroe SEMITECH N-PLC Click Instructions d'installation et d'utilisation

Intel

Intel Agilex Manuel utilisateur

Cypress

Cypress CY4607 HX2VL Manuel utilisateur

DIGITAL-LOGIC

DIGITAL-LOGIC MICROSPACE Manuel utilisateur

Texas Instruments

Texas Instruments TMS320F2837 D Series Manuel utilisateur

CYPRES

CYPRES CY14NVSRAMKIT-001 Manuel utilisateur

Texas Instruments

Texas Instruments INA-DUAL-2AMP-EVM Manuel utilisateur

Espressif Systems

Espressif Systems ESP8266EX Mode d'emploi

Abov

Abov AC33M8128L Manuel utilisateur

Laird

Laird BL654PA Manuel utilisateur